Learn to collect, analyze and share cyber threat intelligence using the intelligence lifecycle, MITRE ATT&CK, the Diamond Model and STIX/TAXII, producing reports that guide defense decisions.
The Cyber Threat Intelligence & Analysis course in Doha, Qatar shows how to turn raw threat data into intelligence that helps an organization make better security decisions. Participants work through the intelligence lifecycle of direction, collection, processing, analysis, dissemination and feedback, and learn to distinguish strategic, operational and tactical intelligence. Analytical models are at the core: MITRE ATT&CK for describing adversary behavior, the Diamond Model of Intrusion Analysis for linking adversaries, capabilities, infrastructure and victims, and the Cyber Kill Chain and Pyramid of Pain for prioritizing defenses.
Practical sessions use public threat reports, open-source feeds and sample incident data. Learners define intelligence requirements, pivot on indicators, map a campaign to ATT&CK techniques, structure findings in STIX 2.1 and explore sharing over TAXII using platforms such as MISP and OpenCTI. Attention is also given to source reliability, cognitive bias, the Traffic Light Protocol and writing for different audiences. The course can also be delivered as an in-house program aligned with an organization's sector and threat profile.
By the end of this course, participants will be able to:
Apply the intelligence lifecycle and define priority intelligence requirements
Distinguish strategic, operational and tactical intelligence and their consumers
Map adversary behavior to MITRE ATT&CK tactics, techniques and procedures
Analyze intrusions using the Diamond Model and Cyber Kill Chain
Structure and share intelligence with STIX 2.1, TAXII and the Traffic Light Protocol
Write intelligence reports that reduce bias and support defense decisions
This course is designed for security professionals who produce, manage or act on threat intelligence.
Threat intelligence analysts
SOC analysts and threat hunters
Incident responders and detection engineers
Information security managers and risk analysts
Fraud and security investigators working with cyber data
Data, information and intelligence: key differences
Intelligence lifecycle from direction to feedback
Strategic, operational and tactical intelligence
Priority intelligence requirements and stakeholder needs
OSINT, commercial feeds, ISACs and internal telemetry
Indicators of compromise versus behavioral indicators
Pivoting on domains, IP addresses and file hashes
Assessing source reliability and information credibility
MITRE ATT&CK tactics, techniques and the ATT&CK Navigator
Diamond Model of Intrusion Analysis
Cyber Kill Chain and the Pyramid of Pain
Tracking threat actors and campaigns
Structured analytic techniques, including analysis of competing hypotheses
Recognizing cognitive biases in intelligence work
Estimative language and confidence levels
Linking intelligence to detection and threat hunting
STIX 2.1 objects and TAXII 2.1 sharing
Threat intelligence platforms such as MISP and OpenCTI
Traffic Light Protocol and responsible sharing
Writing reports for executives, analysts and engineers
Qatar's energy, finance, government, aviation and telecom sectors attract attention from a wide range of threat actors, and the country's role in hosting major international events has made digital resilience a national priority. National cybersecurity guidance encourages organizations to share information and understand the threats they face. Analysts who can produce timely, relevant intelligence help defenders focus on what matters, supporting Qatar National Vision 2030's goal of a secure and knowledge-based economy.
Join a scheduled class at our training center in Doha or attend live online. For organizations, the course can run as an in-house program at your premises or online, tailored to your sector, examples and schedule.
It is a practical course in Doha that teaches how to collect, analyze and share threat intelligence using the intelligence lifecycle, MITRE ATT&CK, the Diamond Model and STIX/TAXII, and how to write reports that help security teams and leaders make decisions.
Threat intelligence analysts, SOC analysts, threat hunters, incident responders, detection engineers and security managers who consume intelligence. Participants should already understand common attack techniques and security operations, ideally from SOC or incident response experience.
No. Indicators are only one output, and they change quickly. The course emphasizes understanding adversary behavior, intent and capability, mapping it to frameworks like MITRE ATT&CK, and producing assessments that guide detection priorities, risk decisions and investments.
Yes. It can be delivered at your premises or online and tailored to your sector, threat profile and intelligence tools, and your schedule. Contact Leaders Training Center to plan an in-house program for your security team.
Tell us a little about yourself and an advisor will contact you about batch timings, fees and eligibility. No obligation.
Sat–Thu: 09:00–22:00Fri: 08:00–22:00
Build a solid technical grounding in cybersecurity: core security principles, common threats, network and endpoint defenses, identity controls and the frameworks IT teams use to manage risk.
Learn how attackers find and exploit weaknesses, and practice reconnaissance, scanning, enumeration and basic exploitation in an isolated lab, always within legal authorization and an agreed scope.
Learn to plan, run and report a structured penetration test, from scoping and rules of engagement through network, web and Active Directory testing in a lab to risk-rated findings.
Prepare for the CompTIA Security+ exam by working through its domains, from threats and security architecture to operations and governance, with labs, scenario questions and practice reviews.
